Re: [PATCH] Fix two client-side NULL dereferences on malformed result sets (libpq, pg_receivewal)

> On Nov 11, 2026, at 14:46, Fujii Masao <masao(dot)fujii(at)gmail(dot)com> wrote:
>
> On Tue, Nov 10, 2026 at 5:57 PM Chao Li <li(dot)evan(dot)chao(at)gmail(dot)com> wrote:
>> So 0002 also looks good to me.
>
> Both patches look good to me too.
> We should backpatch them to all supported versions?

I think that would be great.

>
> BTW, there seem similar missing column-count checks in BaseBackup()
> in pg_basebackup.c:
>
> - The backup start and end position results are checked for one row,
> but not for at least one column, before passing column 0 to strlcpy().
> - The tablespace header is checked for rows, but not for at least
> three columns, before passing column 2 to atoll().
>
> Malformed responses could therefore cause NULL dereferences here too.
> We should fix these separately?
>

I just checked BaseBackup(). There are 3 places to add the check. How about the attached fix? After adding the column count check, we need to change the original error message in form of “got %d rows and %d fields, expected %d rows and %d fields”.

Best regards,
--
Chao Li (Evan)
HighGo Software Co., Ltd.
https://www.highgo.com/